CVE-2021-23347: Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2
Summary
CVE-2021-23347: Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd. Affects github.com/argoproj/argo-cd across 2 version ranges.
< 1.7.13
>= 1.8.0, < 1.8.6
Fixed in 1.7.13 or 1.8.6, depending on the release line you run. How to fix ↓
Also tracked for
- argo-cd · Bitnami
- github.com/argoproj/argo-cd/v2 · Go
The same CVE-2021-23347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/argoproj/argo-cd is a Go package that provides a command-line interface (CLI) for interacting with the Argo CD Continuous Delivery platform. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It automates the deployment of applications to Kubernetes clusters, ensuring consistency and reliability. The vulnerability affects the SSO (Single Sign-On) functionality of the CLI in the v2 version of the package.
Vulnerability Detail
The vulnerability (CVE-2021-23347) is a possible XSS (Cross-Site Scripting) issue that arises when using SSO with the CLI in github.com/argoproj/argo-cd/v2. XSS occurs when an attacker is able to inject malicious scripts into a trusted website, which are then executed by the victim's browser. In this case, the vulnerability allows an attacker to potentially execute arbitrary JavaScript code within the context of the Argo CD CLI, leading to various security risks such as session hijacking, data theft, or unauthorized actions.
How To Fix
Latest published version: v1.8.7 as of 22 Oct 2026
go get github.com/argoproj/argo-cd@v1.8.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.131.7.13go get github.com/argoproj/argo-cd@v1.7.13 -
>= 1.8.0, < 1.8.61.8.6go get github.com/argoproj/argo-cd@v1.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability (CVE-2021-23347) in github.com/argoproj/argo-cd/v2 exposes a possible XSS issue when using SSO with the CLI. It is crucial to update the package to the fixed versions to mitigate the risk of arbitrary JavaScript code execution and potential security breaches. Developers should promptly update their dependencies and ensure the updated package is used in their applications.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into trusted websites, which are then executed by the victim's browser.
The vulnerability allows an attacker to potentially execute arbitrary JavaScript code within the context of the Argo CD CLI, leading to various security risks such as session hijacking, data theft, or unauthorized actions.
The vulnerability affects versions 0 and later of github.com/argoproj/argo-cd/v2. Versions 1.7.13 and 1.8.6 of github.com/argoproj/argo-cd are also affected, but there are fixed versions available.
To fix the vulnerability, update the package to version 1.7.13 or 1.8.6 for github.com/argoproj/argo-cd, or to version 1.8.0 or later for github.com/argoproj/argo-cd/v2. Update your dependencies and ensure the updated package is used in your applications.
No specific workaround is mentioned for this vulnerability. It is recommended to update the package to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
